Privacy policy

1. Controller

The controller is the owner named in the legal notice. For any data protection matter, write to [email protected].

2. What data we process

Account: email, username, hashed password (never stored in plain text), language, the date you declared being 16 or older, and your role. If you sign in with Google, also the identifier Google gives us.

Sessions: the IP address and browser of each open session, while it lasts. Abuse protection: the IP address in the rate-limit counters, for one day at most.

Game: your saved games, your progress (level, achievements and career) and the game events that produce them. Activity: the days on which you use the service. Reports: what you send us with the report button.

We do not ask for your date of birth or any payment details.

3. Purposes and legal basis

To provide the service and manage your account (performance of a contract, Art. 6(1)(b) GDPR). For security and abuse prevention, and for aggregated internal statistics that help us improve the game (legitimate interest, Art. 6(1)(f)). The only emails we send are about your account: verification and password recovery. There are no advertising or game emails.

4. Cookies

We use necessary cookies: the session cookie, which keeps you signed in across the games, and your language and theme preferences. No consent is needed for these. We also show advertising from Google AdSense. Google and its partners may use cookies and identifiers to show ads (personalised or not), limit repetition and measure performance, but only if you accept in the cookie message we show you on arrival. You can change your choice at any time with "Cookie settings" at the foot of the pages. Google processes that data as a controller; see its privacy policy for advertising partners for details.

5. Where your data is and who helps us

The server and the database are in Madrid (Oracle Cloud, European Union).

Cloudflare: content delivery, attack protection, bot verification (Turnstile), email forwarding and encrypted backups in storage under EU jurisdiction. Resend: sending account emails. Google: only if you choose to sign in with Google.

Cloudflare and Resend are US companies and may process some data there; those transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses. A data processing agreement is in place with each provider.

6. How long we keep it

For as long as you have an account. Sessions are deleted when they expire and rate-limit IP addresses within a day. If you delete your account, all your data is removed at once; only an anonymous count of deleted accounts remains. Backups are kept for 30 days and then deleted.

7. Your rights

You can download all your data (access and portability) and delete your account (erasure) yourself from the account settings. To correct data, object to or restrict processing, write to [email protected]; we answer within one month.

You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the authority of your country of residence.

8. Changes

If we change this policy in a relevant way, we will announce it on the website.